<!DOCTYPE html>
<script>

function boom()
{
  document.documentElement.removeChild(document.body);
  var newBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
  document.documentElement.appendChild(newBody);
  newBody.contentEditable = "true";
  document.execCommand("inserthtml", false, "<textarea>a</textarea>");
  document.execCommand("insertimage", false, "1.jpg");
  try { document.execCommand("forwardDelete", false, null); } catch(e) { }
  document.execCommand("inserthtml", false, "x<span><\/span>y");
}

</script>

<body onload="boom();"></body>
